{
  "schemaVersion": "1.0",
  "item": {
    "slug": "isms-audit-expert",
    "name": "Isms Audit Expert",
    "source": "tencent",
    "type": "skill",
    "category": "安全合规",
    "sourceUrl": "https://clawhub.ai/alirezarezvani/isms-audit-expert",
    "canonicalUrl": "https://clawhub.ai/alirezarezvani/isms-audit-expert",
    "targetPlatform": "OpenClaw"
  },
  "install": {
    "downloadMode": "redirect",
    "downloadUrl": "/downloads/isms-audit-expert",
    "sourceDownloadUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=isms-audit-expert",
    "sourcePlatform": "tencent",
    "targetPlatform": "OpenClaw",
    "installMethod": "Manual import",
    "extraction": "Extract archive",
    "prerequisites": [
      "OpenClaw"
    ],
    "packageFormat": "ZIP package",
    "includedAssets": [
      "SKILL.md",
      "references/cloud-security-audit.md",
      "references/iso27001-audit-methodology.md",
      "references/security-control-testing.md",
      "scripts/isms_audit_scheduler.py"
    ],
    "primaryDoc": "SKILL.md",
    "quickSetup": [
      "Download the package from Yavira.",
      "Extract the archive and review SKILL.md first.",
      "Import or place the package into your OpenClaw setup."
    ],
    "agentAssist": {
      "summary": "Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.",
      "steps": [
        "Download the package from Yavira.",
        "Extract it into a folder your agent can access.",
        "Paste one of the prompts below and point your agent at the extracted folder."
      ],
      "prompts": [
        {
          "label": "New install",
          "body": "I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Tell me what you changed and call out any manual steps you could not complete."
        },
        {
          "label": "Upgrade existing",
          "body": "I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Summarize what changed and any follow-up checks I should run."
        }
      ]
    },
    "sourceHealth": {
      "source": "tencent",
      "status": "healthy",
      "reason": "direct_download_ok",
      "recommendedAction": "download",
      "checkedAt": "2026-04-23T16:43:11.935Z",
      "expiresAt": "2026-04-30T16:43:11.935Z",
      "httpStatus": 200,
      "finalUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=4claw-imageboard",
      "contentType": "application/zip",
      "probeMethod": "head",
      "details": {
        "probeUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=4claw-imageboard",
        "contentDisposition": "attachment; filename=\"4claw-imageboard-1.0.1.zip\"",
        "redirectLocation": null,
        "bodySnippet": null
      },
      "scope": "source",
      "summary": "Source download looks usable.",
      "detail": "Yavira can redirect you to the upstream package for this source.",
      "primaryActionLabel": "Download for OpenClaw",
      "primaryActionHref": "/downloads/isms-audit-expert"
    },
    "validation": {
      "installChecklist": [
        "Use the Yavira download entry.",
        "Review SKILL.md after the package is downloaded.",
        "Confirm the extracted package contains the expected setup assets."
      ],
      "postInstallChecks": [
        "Confirm the extracted package includes the expected docs or setup files.",
        "Validate the skill or prompts are available in your target agent workspace.",
        "Capture any manual follow-up steps the agent could not complete."
      ]
    },
    "downloadPageUrl": "https://openagent3.xyz/downloads/isms-audit-expert",
    "agentPageUrl": "https://openagent3.xyz/skills/isms-audit-expert/agent",
    "manifestUrl": "https://openagent3.xyz/skills/isms-audit-expert/agent.json",
    "briefUrl": "https://openagent3.xyz/skills/isms-audit-expert/agent.md"
  },
  "agentAssist": {
    "summary": "Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.",
    "steps": [
      "Download the package from Yavira.",
      "Extract it into a folder your agent can access.",
      "Paste one of the prompts below and point your agent at the extracted folder."
    ],
    "prompts": [
      {
        "label": "New install",
        "body": "I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Tell me what you changed and call out any manual steps you could not complete."
      },
      {
        "label": "Upgrade existing",
        "body": "I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Summarize what changed and any follow-up checks I should run."
      }
    ]
  },
  "documentation": {
    "source": "clawhub",
    "primaryDoc": "SKILL.md",
    "sections": [
      {
        "title": "ISMS Audit Expert",
        "body": "Internal and external ISMS audit management for ISO 27001 compliance verification, security control assessment, and certification support."
      },
      {
        "title": "Table of Contents",
        "body": "Audit Program Management\nAudit Execution\nControl Assessment\nFinding Management\nCertification Support\nTools\nReferences"
      },
      {
        "title": "Risk-Based Audit Schedule",
        "body": "Risk LevelAudit FrequencyExamplesCriticalQuarterlyPrivileged access, vulnerability management, loggingHighSemi-annualAccess control, incident response, encryptionMediumAnnualPolicies, awareness training, physical securityLowAnnualDocumentation, asset inventory"
      },
      {
        "title": "Annual Audit Planning Workflow",
        "body": "Review previous audit findings and risk assessment results\nIdentify high-risk controls and recent security incidents\nDetermine audit scope based on ISMS boundaries\nAssign auditors ensuring independence from audited areas\nCreate audit schedule with resource allocation\nObtain management approval for audit plan\nValidation: Audit plan covers all Annex A controls within certification cycle"
      },
      {
        "title": "Auditor Competency Requirements",
        "body": "ISO 27001 Lead Auditor certification (preferred)\nNo operational responsibility for audited processes\nUnderstanding of technical security controls\nKnowledge of applicable regulations (GDPR, HIPAA)"
      },
      {
        "title": "Pre-Audit Preparation",
        "body": "Review ISMS documentation (policies, SoA, risk assessment)\nAnalyze previous audit reports and open findings\nPrepare audit plan with interview schedule\nNotify auditees of audit scope and timing\nPrepare checklists for controls in scope\nValidation: All documentation received and reviewed before opening meeting"
      },
      {
        "title": "Audit Conduct Steps",
        "body": "Opening Meeting\n\nConfirm audit scope and objectives\nIntroduce audit team and methodology\nAgree on communication channels and logistics\n\n\n\nEvidence Collection\n\nInterview control owners and operators\nReview documentation and records\nObserve processes in operation\nInspect technical configurations\n\n\n\nControl Verification\n\nTest control design (does it address the risk?)\nTest control operation (is it working as intended?)\nSample transactions and records\nDocument all evidence collected\n\n\n\nClosing Meeting\n\nPresent preliminary findings\nClarify any factual inaccuracies\nAgree on finding classification\nConfirm corrective action timelines\n\n\n\nValidation: All controls in scope assessed with documented evidence"
      },
      {
        "title": "Control Testing Approach",
        "body": "Identify control objective from ISO 27002\nDetermine testing method (inquiry, observation, inspection, re-performance)\nDefine sample size based on population and risk\nExecute test and document results\nEvaluate control effectiveness\nValidation: Evidence supports conclusion about control status\n\nFor detailed technical verification procedures by Annex A control, see security-control-testing.md."
      },
      {
        "title": "Finding Classification",
        "body": "SeverityDefinitionResponse TimeMajor NonconformityControl failure creating significant risk30 daysMinor NonconformityIsolated deviation with limited impact90 daysObservationImprovement opportunityNext audit cycle"
      },
      {
        "title": "Finding Documentation Template",
        "body": "Finding ID: ISMS-[YEAR]-[NUMBER]\nControl Reference: A.X.X - [Control Name]\nSeverity: [Major/Minor/Observation]\n\nEvidence:\n- [Specific evidence observed]\n- [Records reviewed]\n- [Interview statements]\n\nRisk Impact:\n- [Potential consequences if not addressed]\n\nRoot Cause:\n- [Why the nonconformity occurred]\n\nRecommendation:\n- [Specific corrective action steps]"
      },
      {
        "title": "Corrective Action Workflow",
        "body": "Auditee acknowledges finding and severity\nRoot cause analysis completed within 10 days\nCorrective action plan submitted with target dates\nActions implemented by responsible parties\nAuditor verifies effectiveness of corrections\nFinding closed with evidence of resolution\nValidation: Root cause addressed, recurrence prevented"
      },
      {
        "title": "Stage 1 Audit Preparation",
        "body": "Ensure documentation is complete:\n\nISMS scope statement\n Information security policy (management signed)\n Statement of Applicability\n Risk assessment methodology and results\n Risk treatment plan\n Internal audit results (past 12 months)\n Management review minutes"
      },
      {
        "title": "Stage 2 Audit Preparation",
        "body": "Verify operational readiness:\n\nAll Stage 1 findings addressed\n ISMS operational for minimum 3 months\n Evidence of control implementation\n Security awareness training records\n Incident response evidence (if applicable)\n Access review documentation"
      },
      {
        "title": "Surveillance Audit Cycle",
        "body": "PeriodFocusYear 1, Q2High-risk controls, Stage 2 findings follow-upYear 1, Q4Continual improvement, control sampleYear 2, Q2Full surveillanceYear 2, Q4Re-certification preparation\n\nValidation: No major nonconformities at surveillance audits."
      },
      {
        "title": "scripts/",
        "body": "ScriptPurposeUsageisms_audit_scheduler.pyGenerate risk-based audit planspython scripts/isms_audit_scheduler.py --year 2025 --format markdown"
      },
      {
        "title": "Audit Planning Example",
        "body": "# Generate annual audit plan\npython scripts/isms_audit_scheduler.py --year 2025 --output audit_plan.json\n\n# With custom control risk ratings\npython scripts/isms_audit_scheduler.py --controls controls.csv --format markdown"
      },
      {
        "title": "References",
        "body": "FileContentiso27001-audit-methodology.mdAudit program structure, pre-audit phase, certification supportsecurity-control-testing.mdTechnical verification procedures for ISO 27002 controlscloud-security-audit.mdCloud provider assessment, configuration security, IAM review"
      },
      {
        "title": "Audit Performance Metrics",
        "body": "KPITargetMeasurementAudit plan completion100%Audits completed vs. plannedFinding closure rate>90% within SLAClosed on time vs. totalMajor nonconformities0 at certificationCount per certification cycleAudit effectivenessIncidents preventedSecurity improvements implemented"
      }
    ],
    "body": "ISMS Audit Expert\n\nInternal and external ISMS audit management for ISO 27001 compliance verification, security control assessment, and certification support.\n\nTable of Contents\nAudit Program Management\nAudit Execution\nControl Assessment\nFinding Management\nCertification Support\nTools\nReferences\nAudit Program Management\nRisk-Based Audit Schedule\nRisk Level\tAudit Frequency\tExamples\nCritical\tQuarterly\tPrivileged access, vulnerability management, logging\nHigh\tSemi-annual\tAccess control, incident response, encryption\nMedium\tAnnual\tPolicies, awareness training, physical security\nLow\tAnnual\tDocumentation, asset inventory\nAnnual Audit Planning Workflow\nReview previous audit findings and risk assessment results\nIdentify high-risk controls and recent security incidents\nDetermine audit scope based on ISMS boundaries\nAssign auditors ensuring independence from audited areas\nCreate audit schedule with resource allocation\nObtain management approval for audit plan\nValidation: Audit plan covers all Annex A controls within certification cycle\nAuditor Competency Requirements\nISO 27001 Lead Auditor certification (preferred)\nNo operational responsibility for audited processes\nUnderstanding of technical security controls\nKnowledge of applicable regulations (GDPR, HIPAA)\nAudit Execution\nPre-Audit Preparation\nReview ISMS documentation (policies, SoA, risk assessment)\nAnalyze previous audit reports and open findings\nPrepare audit plan with interview schedule\nNotify auditees of audit scope and timing\nPrepare checklists for controls in scope\nValidation: All documentation received and reviewed before opening meeting\nAudit Conduct Steps\n\nOpening Meeting\n\nConfirm audit scope and objectives\nIntroduce audit team and methodology\nAgree on communication channels and logistics\n\nEvidence Collection\n\nInterview control owners and operators\nReview documentation and records\nObserve processes in operation\nInspect technical configurations\n\nControl Verification\n\nTest control design (does it address the risk?)\nTest control operation (is it working as intended?)\nSample transactions and records\nDocument all evidence collected\n\nClosing Meeting\n\nPresent preliminary findings\nClarify any factual inaccuracies\nAgree on finding classification\nConfirm corrective action timelines\n\nValidation: All controls in scope assessed with documented evidence\n\nControl Assessment\nControl Testing Approach\nIdentify control objective from ISO 27002\nDetermine testing method (inquiry, observation, inspection, re-performance)\nDefine sample size based on population and risk\nExecute test and document results\nEvaluate control effectiveness\nValidation: Evidence supports conclusion about control status\n\nFor detailed technical verification procedures by Annex A control, see security-control-testing.md.\n\nFinding Management\nFinding Classification\nSeverity\tDefinition\tResponse Time\nMajor Nonconformity\tControl failure creating significant risk\t30 days\nMinor Nonconformity\tIsolated deviation with limited impact\t90 days\nObservation\tImprovement opportunity\tNext audit cycle\nFinding Documentation Template\nFinding ID: ISMS-[YEAR]-[NUMBER]\nControl Reference: A.X.X - [Control Name]\nSeverity: [Major/Minor/Observation]\n\nEvidence:\n- [Specific evidence observed]\n- [Records reviewed]\n- [Interview statements]\n\nRisk Impact:\n- [Potential consequences if not addressed]\n\nRoot Cause:\n- [Why the nonconformity occurred]\n\nRecommendation:\n- [Specific corrective action steps]\n\nCorrective Action Workflow\nAuditee acknowledges finding and severity\nRoot cause analysis completed within 10 days\nCorrective action plan submitted with target dates\nActions implemented by responsible parties\nAuditor verifies effectiveness of corrections\nFinding closed with evidence of resolution\nValidation: Root cause addressed, recurrence prevented\nCertification Support\nStage 1 Audit Preparation\n\nEnsure documentation is complete:\n\n ISMS scope statement\n Information security policy (management signed)\n Statement of Applicability\n Risk assessment methodology and results\n Risk treatment plan\n Internal audit results (past 12 months)\n Management review minutes\nStage 2 Audit Preparation\n\nVerify operational readiness:\n\n All Stage 1 findings addressed\n ISMS operational for minimum 3 months\n Evidence of control implementation\n Security awareness training records\n Incident response evidence (if applicable)\n Access review documentation\nSurveillance Audit Cycle\nPeriod\tFocus\nYear 1, Q2\tHigh-risk controls, Stage 2 findings follow-up\nYear 1, Q4\tContinual improvement, control sample\nYear 2, Q2\tFull surveillance\nYear 2, Q4\tRe-certification preparation\n\nValidation: No major nonconformities at surveillance audits.\n\nTools\nscripts/\nScript\tPurpose\tUsage\nisms_audit_scheduler.py\tGenerate risk-based audit plans\tpython scripts/isms_audit_scheduler.py --year 2025 --format markdown\nAudit Planning Example\n# Generate annual audit plan\npython scripts/isms_audit_scheduler.py --year 2025 --output audit_plan.json\n\n# With custom control risk ratings\npython scripts/isms_audit_scheduler.py --controls controls.csv --format markdown\n\nReferences\nFile\tContent\niso27001-audit-methodology.md\tAudit program structure, pre-audit phase, certification support\nsecurity-control-testing.md\tTechnical verification procedures for ISO 27002 controls\ncloud-security-audit.md\tCloud provider assessment, configuration security, IAM review\nAudit Performance Metrics\nKPI\tTarget\tMeasurement\nAudit plan completion\t100%\tAudits completed vs. planned\nFinding closure rate\t>90% within SLA\tClosed on time vs. total\nMajor nonconformities\t0 at certification\tCount per certification cycle\nAudit effectiveness\tIncidents prevented\tSecurity improvements implemented"
  },
  "trust": {
    "sourceLabel": "tencent",
    "provenanceUrl": "https://clawhub.ai/alirezarezvani/isms-audit-expert",
    "publisherUrl": "https://clawhub.ai/alirezarezvani/isms-audit-expert",
    "owner": "alirezarezvani",
    "version": "2.1.1",
    "license": null,
    "verificationStatus": "Indexed source record"
  },
  "links": {
    "detailUrl": "https://openagent3.xyz/skills/isms-audit-expert",
    "downloadUrl": "https://openagent3.xyz/downloads/isms-audit-expert",
    "agentUrl": "https://openagent3.xyz/skills/isms-audit-expert/agent",
    "manifestUrl": "https://openagent3.xyz/skills/isms-audit-expert/agent.json",
    "briefUrl": "https://openagent3.xyz/skills/isms-audit-expert/agent.md"
  }
}